OSCAL Assessment Results field mapping
CAM exports engagement and control test result data to the OSCAL Assessment Results (AR) format using the following field mappings.
Metadata
The metadata section exports the roles, parties, and responsible parties associated with the engagement and POA&M.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
last-modified |
Last modified timestamp of the engagement |
roles[].id |
Role ID. Exported values include: engagement_lead, approvers, auditors, control_test_owner, poam-owner,
poam-manager, poam-manager-group, watchlistpoam-ownerpoam-manager poam-manager-group |
roles[].title |
Display title of the role (for example, Engagement Lead, Control Test Owner, POAM Owner) |
parties[].uuid |
UUID of the user or group |
parties[].name |
Name of the user or group |
parties[].type |
Party type: person or organization |
responsible-parties[].role-id |
Role ID assigned to a party (for example, engagement_lead, poam-owner) |
name="actual_cost" |
Engagement actual/work cost name |
name="report_template" |
Engagement report template |
responsible-parties[].party-uuids[] |
UUID of the user or group assigned to the role |
Import AP
The import-ap field links the AR to the Assessment Plan (AP) from which it was generated.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
import-ap.href |
UUID of the Assessment Plan linked to this Assessment Results file |
Activities
The activities array contains one object per control test. Each object exports control test details, related controls, and assessment procedures.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
uuid |
Control test UUID |
title |
Control test short description |
description |
Control test description |
responsible-roles[].role-id |
Role of the control test owner (control_test_owner) |
responsible-roles[].party-uuids[] |
UUID of the user assigned to the control test (Assigned to) |
related-controls.control-selections[].include-controls[].control-id |
ID of the control linked to the control test |
related-controls.control-selections[].include-controls[].statement-ids[] |
Control requirement IDs linked to the control test |
related-controls.control-selections[].name="entity" |
Entity linked to the control test |
related-controls.control-objective-selections[].include-objectives[].objective-id |
Control objective ID linked to the control test |
steps[].uuid |
Assessment procedure UUID |
steps[].description |
Assessment procedure description |
steps[].name="label" |
Assessment procedure identifier (label) |
name="state" |
Control test state (for example, Closed Complete) |
name="operation_effectiveness" |
Operating effectiveness of the control test |
name="operation_assessment_procedures" |
Assessment procedures description |
name="test_plan_uuid" |
UUID of the test plan linked to the control test |
name="interview" |
Interview sources for the control test |
name="examine" |
Examine sources for the control test |
name="test" |
Test sources for the control test |
name="method" |
Assessment method (for example, TEST) |
name="planned_start_date" |
Planned start date of the control test |
name="planned_end_date" |
Planned end date of the control test |
name="actual_start_date" |
Actual start date of the control test |
name="actual_end_date" |
Actual end date of the control test |
Results — engagement properties
The results[].props array exports engagement-level fields that are captured during the assessment lifecycle.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
name="state" |
Engagement state |
name="short_description" |
Engagement short description |
name="entity" |
Entity linked to the engagement |
name="engagement_starts" |
Engagement start step (for example, Fieldwork) |
name="engagement_ends" |
Engagement end step (for example, Closed) |
name="schedule_start_date" |
Scheduled start date |
name="schedule_end_date" |
Scheduled end date |
name="fieldwork_start_date" |
Fieldwork start date |
name="fieldwork_end_date" |
Fieldwork end date |
name="planned_start_date" |
Planned start date |
name="budget_cost" |
Budget cost |
name="planned_cost" |
Planned cost |
name="percent_complete" |
Percent complete |
name="fieldwork_complete_percentage" |
Fieldwork complete percentage |
name="active" |
Whether the engagement is active |
Results — Reviewed controls
The results[].reviewed-controls object exports the controls and control objectives linked to the engagement.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
control-selections[].name="entity" |
Entity linked to the control selection |
control-selections[].include-controls[].control-id |
Control ID |
control-selections[].include-controls[].statement-ids[] |
Control requirement IDs |
control-objective-selections[].include-objectives[].objective-id |
Control objective ID |
Results — Findings
The results[].findings array exports POA&M items, milestones, and acceptance tasks linked to control tests in the engagement.
POA&M items
Each finding object represents one POA&M item.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
uuid |
POA&M item UUID |
title |
POA&M item title |
description |
POA&M item description |
target.target-id |
ID of the control objective that the finding targets |
target.type |
Target type (objective-id) |
target.name="target-uuid" |
UUID of the control test linked to the POA&M item |
status.state |
Finding status (for example, not-satisfied) |
name="state" |
POA&M item state (for example, Respond) |
name="priority" |
POA&M item priority (for example, 4 – Low) |
name="response" |
POA&M response (for example, Remediate, Accept) |
name="explanation" |
POA&M explanation |
name="issue_type" |
Issue type (for example, Control design effectiveness failure) |
Milestones
Milestone fields are exported as props within the finding object associated with the POA&M item.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
name="state" |
Milestone state |
name="priority" |
Milestone priority |
name="short_description" |
Milestone short description |
name="description" |
Milestone description |
name="parent" |
Parent POA&M item |
name="assigned_to" |
User assigned to the milestone |
name="watch_list" |
Watch list for the milestone |
name="planned_start_date" |
Planned start date |
name="planned_end_date" |
Planned end date |
name="actual_start_date" |
Actual start date |
name="actual_end_date" |
Actual end date |
Acceptance tasks
Acceptance task fields are exported as props within the finding object associated with the POA&M item. Acceptance tasks export all milestone fields plus the following additional fields.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
name="weakness_description" |
Weakness description |
name="effect_on_business" |
Effect on business |
name="risk_acceptance_request" |
Risk acceptance request |
name="business_justification" |
Business justification |
name="justification_for_request" |
Justification for request |
Results — Attestations
The results[].attestations array exports control test effectiveness data. Each object in parts represents one control test, and the nested parts within it represent the
assessment procedures of that control test.
| OSCAL AR field | ServiceNow CAM field |
|---|---|
responsible-parties[].role-id |
Role of the control test owner (control_test_owner) |
responsible-parties[].party-uuids[] |
UUID of the control test owner |
parts[].uuid |
Control test UUID |
parts[].title |
Control test short description |
parts[].class |
Object class (control-test) |
parts[].name |
Part name (objective) |
parts[].prose |
Control effectiveness value (for example, ineffective) |
parts[].name="operation_effectiveness" |
Operating effectiveness of the control test |
parts[].name="operation_assessment_procedures" |
Assessment procedures description |
parts[].name="planned_start_date" |
Planned start date of the control test |
parts[].name="planned_end_date" |
Planned end date of the control test |
parts[].name="actual_start_date" |
Actual start date of the control test |
parts[].name="actual_end_date" |
Actual end date of the control test |
parts[].name="method" |
Assessment method |
parts[].parts[].uuid |
Assessment procedure UUID |
parts[].parts[].title |
Assessment procedure description |
parts[].parts[].class |
Object class (assessment-procedure) |
parts[].parts[].name |
Part name (objective) |
parts[].parts[].prose |
Assessment procedure effectiveness value (for example, ineffective) |
parts[].parts[].name="label" |
Assessment procedure identifier (label) |
parts[].parts[].name="method" |
Assessment method for the assessment procedure |